{"id":"CVE-2022-38349","details":"An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.","modified":"2026-08-12T13:33:08.517533Z","published":"2023-08-22T00:00:00Z","related":["SUSE-SU-2023:3947-1","SUSE-SU-2023:3981-1","SUSE-SU-2023:3982-1","SUSE-SU-2023:3983-1","SUSE-SU-2023:3998-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38349.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00037.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38349.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38349"},{"type":"REPORT","url":"https://gitlab.freedesktop.org/poppler/poppler/-/issues/1282"},{"type":"FIX","url":"https://gitlab.freedesktop.org/poppler/poppler/-/commit/4564a002bcb6094cc460bc0d5ddff9423fe6dd28"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.freedesktop.org/poppler/poppler","events":[{"introduced":"12853d22e9d0527c10ada02666aef629db3e5e7c"},{"fixed":"4564a002bcb6094cc460bc0d5ddff9423fe6dd28"}],"database_specific":{"cpe":"cpe:2.3:a:freedesktop:poppler:22.08.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"22.08.0"},{"last_affected":"22.08.0"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["22.08.0","poppler-22.08.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-38349.json","vanir_signatures_modified":"2026-08-12T13:33:08Z","vanir_signatures":[{"target":{"file":"poppler/PDFDoc.cc","function":"PDFDoc::replacePageDict"},"deprecated":false,"digest":{"function_hash":"278198337781370379682767387665560638766","length":1221},"id":"CVE-2022-38349-655d0887","signature_type":"Function","signature_version":"v1","source":"https://gitlab.freedesktop.org/poppler/poppler@4564a002bcb6094cc460bc0d5ddff9423fe6dd28"},{"source":"https://gitlab.freedesktop.org/poppler/poppler@4564a002bcb6094cc460bc0d5ddff9423fe6dd28","target":{"file":"utils/pdfunite.cc"},"deprecated":false,"digest":{"line_hashes":["208287840360781646675936020976936566019","35725193396377480983840216143287832211","338669630972771371426897273815972287705","285804276582019238211749775458293638825"],"threshold":0.9},"id":"CVE-2022-38349-6c725609","signature_type":"Line","signature_version":"v1"},{"target":{"file":"utils/pdfunite.cc","function":"main"},"deprecated":false,"digest":{"function_hash":"199033974222301744162180022108029061501","length":9527},"id":"CVE-2022-38349-78105dbb","signature_type":"Function","signature_version":"v1","source":"https://gitlab.freedesktop.org/poppler/poppler@4564a002bcb6094cc460bc0d5ddff9423fe6dd28"},{"deprecated":false,"digest":{"line_hashes":["119061681459072995336749164204409614205","310601896054141298882793475127531963740","323767781644168077073788382404741565414","121335891706566284415627501913965562186"],"threshold":0.9},"id":"CVE-2022-38349-9194e3a2","signature_type":"Line","signature_version":"v1","source":"https://gitlab.freedesktop.org/poppler/poppler@4564a002bcb6094cc460bc0d5ddff9423fe6dd28","target":{"file":"poppler/PDFDoc.h"}},{"digest":{"line_hashes":["220753405548428387183197371674658079372","160188165752855857011810481816624076617","109193999749591786407712572863962726399","257785743474255470521539602907411694022","84314911086220442048839528856815015840","224348102061797659199028422702240896381","132382132251429852516410338485519729772","228420466485419239135845902785795784688","108851965955581414550174860359531579715","128398370585023614830370983689588803211","215950284366318878634162444450763235626"],"threshold":0.9},"id":"CVE-2022-38349-ba472c8d","signature_type":"Line","signature_version":"v1","source":"https://gitlab.freedesktop.org/poppler/poppler@4564a002bcb6094cc460bc0d5ddff9423fe6dd28","target":{"file":"poppler/PDFDoc.cc"},"deprecated":false}]}}],"schema_version":"1.9.0"}